This is an automated email from the ASF dual-hosted git repository.
kfaraz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/druid.git
The following commit(s) were added to refs/heads/master by this push:
new 2a2e474dd47 release: Suppress CVEs that do not affect Druid (#20236)
2a2e474dd47 is described below
commit 2a2e474dd4769812095afe2c838126f67600f213
Author: Kashif Faraz <[email protected]>
AuthorDate: Thu Oct 15 19:10:24 2026 +0530
release: Suppress CVEs that do not affect Druid (#20236)
List of suppressed CVEs:
- elasticache-java-cluster-client: client lib, not memcached server (CPE
false positive)
- dev.cel:protobuf: CPE collision with google protobuf-java (CVE-2022-3171)
- async-http-client: no auto-redirect/cookie store in Druid's usage
(CVE-2026-45300)
- netty-transport 4.1.100: hostname verification enabled in
ChannelResourceFactory
(CVE-2023-4586)
- npm uuid: only uuidv4() used, no buf argument (GHSA-w5hq-g745-h8pq)
- kotlin-stdlib: build-toolchain only, no Kotlin source in Druid
(CVE-2026-53914)
- azure-core/identity/json: Key Vault crypto path unused, blob storage auth
only
(CVE-2026-33117)
- hive-storage-api: used only for Murmur3 hash, no Hive
Metastore/HiveServer2
(CVE-2026-49845, -53561, -55976)
- jackson-databind shaded in hadoop-client-runtime/parquet-jackson
(CVE-2026-54512, -54513, -68497)
- jetty shaded in hadoop-client-runtime, used for Hadoop's internal HTTP
only
(CVE-2026-2332, -10050)
- jline shaded in hadoop-client-runtime, Hadoop CLI only (CVE-2026-56741,
-56740)
- opentelemetry-gcp-resources: CPE collision with OTel Go SDK
(CVE-2026-24051, -39883, -29181)
- httpclient5/httpcore5 shaded in docker-java-transport-zerodep: test-scope
only
(CVE-2026-40542, -71290, -54399, -54428)
- zstd-jni: vulnerable paths not activated, pending upgrade to 1.5.7-14
(CVE-2026-87823, -87795)
- snappy-java: Druid uses Commons Compress, not xerial ByteBuffer API
(CVE-2026-90559)
- parquet-column/parquet-common: envelope encryption/crypto.keytools unused
(CVE-2026-73334)
- zookeeper/zookeeper-jute: used as client only, no server/quorum
(CVE-2026-79993, -59739, -59969)
---
owasp-dependency-check-suppressions.xml | 237 ++++++++++++++++++++++++++++++++
1 file changed, 237 insertions(+)
diff --git a/owasp-dependency-check-suppressions.xml
b/owasp-dependency-check-suppressions.xml
index 1f0193731f1..fd771507518 100644
--- a/owasp-dependency-check-suppressions.xml
+++ b/owasp-dependency-check-suppressions.xml
@@ -19,6 +19,21 @@
-->
<suppressions
xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd";>
<!-- False positives -->
+
+ <suppress>
+ <!-- False positive: the scanner matches the Java client version "1.2.4"
against
+ cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon).
+ elasticache-java-cluster-client is a Java Memcached CLIENT library;
Druid uses it
+ solely to send cache get/set/delete commands to a remote Memcached
server.
+ Druid does not run or embed a Memcached server process, so all CVEs
mapped to
+ the memcached:memcached CPE are false positives for this artifact. -->
+ <notes><![CDATA[
+ file name: elasticache-java-cluster-client-1.2.4.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.amazonaws/elasticache-java-cluster-client@.*$</packageUrl>
+ <cpe>cpe:/a:memcached:memcached</cpe>
+ </suppress>
+
<suppress>
<notes><![CDATA[
file name: json-path-2.9.0.jar jackson-core-2.12.7.jar
@@ -377,6 +392,18 @@
<cve>CVE-2022-3171</cve>
</suppress>
+ <suppress>
+ <!-- CVE-2022-3171: False positive. This CVE affects Google's
protobuf-java (com.google.protobuf),
+ but the scanner matches it against dev.cel:protobuf via the broad
protobuf CPE.
+ dev.cel:protobuf is part of the Common Expression Language library
and is unrelated
+ to Google's protobuf-java parsing code that contains the
vulnerability. -->
+ <notes><![CDATA[
+ file name: protobuf-0.13.0.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/dev\.cel/protobuf@.*$</packageUrl>
+ <cve>CVE-2022-3171</cve>
+ </suppress>
+
<suppress>
<notes><![CDATA[
file name: ansi-regex:5.0.0
@@ -732,4 +759,214 @@
<packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl>
<cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go
(google.golang.org/grpc < 1.79.3), not gRPC Java -
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 -->
</suppress>
+
+
+ <suppress>
+ <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the
optional buf
+ argument is provided. Druid's web console uses only uuidv4() with no
buf argument
+ (web-console/src/druid-models/workbench-query/workbench-query.ts), so
the
+ vulnerable code path is never exercised.
+ Update to version 11.1.1 or 12.0.1 to remove this suppression
+ -->
+ <notes><![CDATA[
+ file name: package-lock.json (pkg:npm/[email protected])
+ ]]></notes>
+ <packageUrl regex="true">^pkg:npm/uuid@7\.0\.3$</packageUrl>
+ <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache
metadata (Kotlin compiler/Gradle plugin).
+ This is a build-toolchain vulnerability, not a runtime stdlib issue.
Druid has no Kotlin source files;
+ kotlin-stdlib is a transitive runtime dependency (via Iceberg) and
Druid never invokes Kotlin's build cache. -->
+ <notes><![CDATA[
+ file name: kotlin-stdlib-2.4.10.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl>
+ <cve>CVE-2026-53914</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys
local cryptographic verification path.
+ The CVE fires against azure-core, azure-core-http-netty,
azure-identity, and azure-json due to broad CPE
+ matching, but none of these jars contain the vulnerable Key Vault
code path. Druid uses these artifacts
+ for blob storage auth only and does not use the Key Vault
cryptography client. -->
+ <notes><![CDATA[
+ file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar
azure-identity-1.18.4.jar azure-json-1.5.1.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.azure/azure-(core@1\.58\.1|core-http-netty@1\.16\.5|identity@1\.18\.4|json@1\.5\.1)$</packageUrl>
+ <cve>CVE-2026-33117</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-49845: SQL injection in Hive Metastore partition-name
resolution.
+ CVE-2026-53561: SAML bearer-token authentication bypass in
HiveServer2.
+ CVE-2026-55976: SSRF via avro.schema.url in Avro SerDe schema
resolution.
+ All three affect Apache Hive server components (Metastore,
HiveServer2).
+ Druid uses hive-storage-api only for the Murmur3 hash utility
+ (BloomKFilter.java) and ORC/Parquet column type definitions — it does
not
+ run or connect to a Hive Metastore or HiveServer2. -->
+ <notes><![CDATA[
+ file name: hive-storage-api-4.2.0.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@.*$</packageUrl>
+ <cve>CVE-2026-49845</cve>
+ <cve>CVE-2026-53561</cve>
+ <cve>CVE-2026-55976</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-54512, CVE-2026-54513: PolymorphicTypeValidator bypass in
jackson-databind when
+ polymorphic typing is enabled with generic type parameters or array
subtypes.
+ CVE-2026-83557: DefaultBaseTypeLimitingValidator omits
java.lang.Comparable from unsafe
+ base types, enabling arbitrary class instantiation via polymorphic
deserialization.
+ These CVEs affect jackson-databind shaded inside hadoop/parquet jars,
+ not Druid's own jackson-databind (2.22.x).
+ CVE-2026-68497: Not yet published in NVD, suppressed as appearing
only inside shaded jars -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind
2.18.6)
+ parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1)
+ ]]></notes>
+ <filePath
regex="true">.*/(hadoop-client-runtime|parquet-jackson)-[0-9][^/]*\.jar/META-INF/maven/com\.fasterxml\.jackson\.core/jackson-databind/pom\.xml$</filePath>
+ <cve>CVE-2026-54512</cve>
+ <cve>CVE-2026-54513</cve>
+ <cve>CVE-2026-68497</cve>
+ <cve>CVE-2026-83557</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-89407, CVE-2026-89425: ReDoS/OOM in jackson-core's number
and error-token parsing
+ of malformed input. Affects jackson-core shaded inside
hadoop-client-runtime-3.5.0.jar
+ and parquet-jackson-1.18.1.jar, not Druid's own jackson-core
(2.22.3). -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-core 2.18.6)
+ parquet-jackson-1.18.1.jar (shaded jackson-core 2.22.2)
+ ]]></notes>
+ <filePath
regex="true">.*/(hadoop-client-runtime|parquet-jackson)-[0-9][^/]*\.jar/META-INF/maven/com\.fasterxml\.jackson\.core/jackson-core/pom\.xml$</filePath>
+ <cve>CVE-2026-89407</cve>
+ <cve>CVE-2026-68498</cve>
+ <cve>CVE-2026-89425</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-2332: Jetty HTTP/1.1 request smuggling via chunk extension
quoted strings.
+ CVE-2026-10050: Jetty Digest auth password encoding using ISO-8859-1.
+ CVE-2026-19203: Jetty HTTP/1.1 request smuggling via lone-LF chunk
terminators.
+ All affect Jetty shaded inside hadoop-client-runtime-3.5.0.jar. Druid
cannot upgrade
+ the Jetty version inside this shaded jar. The shaded Jetty is used
only for Hadoop's
+ internal HTTP server (WebHDFS, etc.), not for Druid's own HTTP server
(Jetty 12.x).
+ Druid does not use Hadoop's embedded Jetty server or Digest auth. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded org.eclipse.jetty*
9.4.58.v20250814)
+ ]]></notes>
+ <filePath
regex="true">.*/(hadoop-client-runtime)-[0-9][^/]*\.jar/META-INF/maven/org\.eclipse\.jetty[^/]*/[^/]*/pom\.xml$</filePath>
+ <cve>CVE-2026-2332</cve>
+ <cve>CVE-2026-10050</cve>
+ <cve>CVE-2026-19203</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-56741, CVE-2026-56740: DoS via JLine Telnet server (NAWS
terminal dimensions and
+ NEW-ENVIRON flooding).
+ CVE-2026-77422, CVE-2026-77423: ReDoS in JLine's built-in grep/less
commands via
+ user-controlled regex.
+ JLine is shaded inside hadoop-client-runtime-3.5.0.jar and is used
+ only for Hadoop's interactive CLI shell. Druid does not expose a
JLine Telnet server
+ endpoint or interactive shell session. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jline 3.9.0)
+ ]]></notes>
+ <filePath
regex="true">.*/(hadoop-client-runtime)-[0-9][^/]*\.jar/META-INF/maven/org\.jline/jline[^/]*/pom\.xml$</filePath>
+ <cve>CVE-2026-56741</cve>
+ <cve>CVE-2026-56740</cve>
+ <cve>CVE-2026-77422</cve>
+ <cve>CVE-2026-77423</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-24051, CVE-2026-39883, CVE-2026-29181: All three affect the
OpenTelemetry Go SDK
+ (opentelemetry-go), not any Java library. The scanner matches
opentelemetry-gcp-resources
+ (a Java artifact) against the Go SDK CPE due to the shared
"opentelemetry" product name.
+ Druid's google-extensions use the Java opentelemetry-gcp-resources
for GCP resource
+ detection; the vulnerable PATH hijacking and baggage-header
amplification code exists
+ only in the Go implementation. -->
+ <notes><![CDATA[
+ file name: opentelemetry-gcp-resources-1.37.0-alpha.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/io\.opentelemetry\.contrib/opentelemetry-gcp-resources@.*$</packageUrl>
+ <cve>CVE-2026-24051</cve>
+ <cve>CVE-2026-39883</cve>
+ <cve>CVE-2026-29181</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-40542, CVE-2026-71290: Vulnerabilities in Apache HttpClient
5 (SCRAM mutual auth
+ and async hostname verification). CVE-2026-54399, CVE-2026-54428: DoS
in Apache HttpComponents
+ Core 5 (excessive headers and HTTP/2 HPACK). All four affect
httpclient5/httpcore5 shaded
+ inside docker-java-transport-zerodep-3.7.1.jar (a test-scoped
dependency used only by
+ druid-testcontainers for Docker container management in tests). These
are not present in
+ Druid's production runtime classpath. -->
+ <notes><![CDATA[
+ file name: docker-java-transport-zerodep-3.7.1.jar (shaded httpclient5
5.5.1, httpcore5 5.3.6, and httpcore5-h2 5.3.6)
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.httpcomponents\.(client5/httpclient5|core5/httpcore5|core5/httpcore5-h2)@.*$</packageUrl>
+ <cve>CVE-2026-40542</cve>
+ <cve>CVE-2026-71290</cve>
+ <cve>CVE-2026-54399</cve>
+ <cve>CVE-2026-54428</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-87823: Out-of-bounds memory read in ByteBuffer frame-size
methods via negative offset values.
+ CVE-2026-87795: Out-of-bounds memory read in ZstdDictCompress
constructor via unvalidated offset/length.
+ Both are fixed in zstd-jni 1.5.7-14. Suppressed until zstd-jni is
upgraded.
+ Based on the analysis in
https://github.com/apache/druid/pull/20236#issuecomment-5646494509,
+ this vulnerability should not affect Druid since the relevant code
paths do not get activated
+ -->
+ <notes><![CDATA[
+ file name: zstd-jni-1.5.7-11.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.github\.luben/zstd-jni@1\.5\.7\-11$</packageUrl>
+ <cve>CVE-2026-87823</cve>
+ <cve>CVE-2026-87795</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-90559/93452: OOB read/write in
Snappy.uncompress/compress(ByteBuffer, ByteBuffer).
+ CVE-2026-108106: unbounded memory allocation during decompression
(fixed in 1.1.10.9).
+ snappy-java is a transitive dependency (via Kafka, Parquet, etc.);
Druid's own snappy
+ compression/decompression uses Apache Commons Compress, not the
xerial ByteBuffer APIs. -->
+ <notes><![CDATA[
+ file name: snappy-java-1.1.10.8.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.xerial\.snappy/snappy-java@1\.1\.10\.8$</packageUrl>
+ <cve>CVE-2026-90559</cve>
+ <cve>CVE-2026-93452</cve>
+ <cve>CVE-2026-108106</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-82463: auth bypass in pac4j-core's
CheckProfileTypeAuthorizer. Not used by Druid.
+ CVE-2026-82461: pac4j-oidc fails to verify tokens when extracting
Keycloak realm/client
+ roles. Druid does not do Keycloak role extraction; it only validates
the ID token via
+ standard OIDC discovery and extracts a single configured claim.
+ Fixed in pac4j 6.5.6+, but 5.x -> 6.x is a major bump with likely
breaking API changes. -->
+ <notes><![CDATA[
+ file name: pac4j-core-5.7.10.jar / pac4j-oidc-5.7.10.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.pac4j/pac4j-(core|oidc)@5\.7\.10$</packageUrl>
+ <cve>CVE-2026-82463</cve>
+ <cve>CVE-2026-82461</cve>
+ </suppress>
+
+ <suppress>
+ <!-- TODO: CVE-2026-93879 has no public details yet (not in NVD, GitHub
Security Advisories,
+ or VulnCheck as of 2026-10-14). Suppressed temporarily to unblock the
build;
+ revisit and re-assess once the advisory is published. -->
+ <notes><![CDATA[
+ file name: hibernate-validator-9.1.4.Final.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.hibernate\.validator/hibernate-validator@.*$</packageUrl>
+ <cve>CVE-2026-93879</cve>
+ </suppress>
</suppressions>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
